prompt caching - #1335
Merged
Merged
Conversation
Add feature pages for the four features this release introduces: - Sub-agents, covering delegation, foreground and background runs, the admin limits and what a sub-agent deliberately cannot do. - Timers, including that they are gated by the Sub-agents setting rather than having one of their own. - Notifications, covering webhook targets, the four subscribable events, away and always delivery, and migration from the old single webhook. - Keyboard shortcuts, with the fifteen rebindable defaults. Document the new configuration: the seven SUBAGENTS_* variables, TIMER_POLL_INTERVAL, USER_PERMISSIONS_ACCESS_GRANTS_ALLOW_GROUPS and ENABLE_PLUGINS, and add delegate_task, timer and notify to the builtin tool tables. Correct what the release made wrong: the title-generation prompt no longer asks for emojis, per-model compaction thresholds are now bounded by a cap rather than by the global threshold, replace_note_content takes range operations, the Webhooks page still described the removed single webhook field, and the Archived Chats path moved. Admin settings are now a section of the Settings dialog rather than a page of their own, so rewrite the paths accordingly, and record the access-grant sharing permissions, the note-chat tool overrides and the new Anthropic token-counting endpoints. Update the schema reference for the chat_message.meta column, and bring the version notes and pinned image examples up to v0.10.3.
The Image Generation permission row described it as a simple capability, but on backends that keep a single image model loaded, selecting a model is the same action as switching the loaded one, so a user holding the permission changes the active image model for the whole instance. Note that alongside the row, with the guidance that deployments which do not want non-admin users changing the shared model should not grant the permission to non-admins, or should use a backend that accepts a model with each request. Also normalise the remaining admin settings paths. The earlier pass matched only unadorned paths, leaving bold, backtick and arrow variants pointing at the old Admin Panel page.
…nd scaling guides Verified against open-webui source (env.py / main.py, starlette-compress 1.7.1): the flag only gates CompressMiddleware, which touches HTTP responses exclusively — WebSocket scope passes through untouched, SSE (text/event-stream) is not in the compressible content-type list, and responses under 500 bytes are never compressed. - Expand the env-configuration reference entry with what the middleware does and does not affect, the CPU/latency upside of disabling (~3-4% per worker per py-spy profiling), the response-size downside (few KB for typical API responses, but multi-MB first page load and 5-10x on large chat/model JSON), and the recommended proxy-offload setup - Add an HTTP Response Compression section to the performance guide's High-Concurrency chapter, plus Profile 3 checklist and env var table entries - Add an "Offload HTTP Compression to the Load Balancer" step-3 section and env-block entry to the scaling guide - Add a compress-at-the-LB best practice to the Scaling & HA troubleshooting guide Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XrkxR1KPMABxNNR3b1xr9R
…ssion When ENABLE_COMPRESSION_MIDDLEWARE is disabled in favor of proxy-level compression, the remaining downside (larger first uncached page load) is eliminated by caching the frontend bundles at the proxy: Open WebUI's SvelteKit build ships all JS/CSS under /_app/immutable/ with content-hashed filenames, so a URL never changes content and the files can be cached with max-age=31536000, immutable and served from the proxy cache without touching a worker. - Scaling guide: new "Pair It with Static Asset Caching at the Proxy" subsection with a ready-made Nginx proxy_cache snippet, the HTML-shell/version.json short-cache caveat (upgrade detection), and on-the-fly compression level guidance (level 4-5, min_length) - Performance guide: "Recommended companion" bullet in the HTTP Response Compression section pointing at the scaling snippet - Env reference: extend the compress-at-the-proxy tip with the /_app/immutable/ caching recommendation - Scaling & HA troubleshooting: mention proxy-side bundle caching in the compress-at-the-LB best practice Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XrkxR1KPMABxNNR3b1xr9R
…e-perf-docs-dgj98w docs: document ENABLE_COMPRESSION_MIDDLEWARE trade-offs across perf a…
…legacy The reference documented CODE_INTERPRETER_BLACKLISTED_MODULES, a name that does not exist in the code, and described it as a security control. Rename it to CODE_INTERPRETER_BLOCKED_MODULES and describe what it does: empty by default so the blocking hook is never installed, and when set it intercepts only direct top-level imports, leaving indirect imports and the modules themselves in place. It is an opt-in convenience filter, not a security boundary; the isolation is the execution engine. Mark the code execution and code interpreter sections as legacy, since both the pyodide and jupyter engines are legacy and Open Terminal is the supported path for code and shell execution. Fix the same stale variable name on the Python code execution page.
Add the green "Resolved: this CVE is now rejected" callout to the six huntr CVE pages (2024-7033/7034/7038/7039/7040/7959), matching the older rejected pages, since all six were withdrawn by their issuing CNA. On CVE-2024-7033, state what the download host allowlist is for: it keeps downloads pointed at the intended model source and does not constrain where the bytes land, so the backslash traversal is not a bypass of a filesystem-write boundary. On the ZDI records (2026-0765/0766/0767), lead the severity discussion with the disposition. Because the reports describe intended behavior or a deployment property, no CVSS score applies; the privilege-metric correction is kept as a secondary, conditional note rather than the argument.
Adds the personal Usage view (Settings > Usage) and its GET /api/v1/users/usage endpoint to the Analytics page, chat forking to the chat features overview, and the chat.current_message_id column with migration 9a1b2c3d4e5f to the database schema reference. Updates the Automatic1111 note in the permissions docs, where switching the instance-wide image model is now restricted to administrators. Documents the Anthropic Messages endpoint's thinking blocks, reasoning-effort and structured-output mapping, the per-connection passthrough_params field, the OpenAI-compatible /ollama/v1/embeddings proxy, the admin-panel location of the LDAP group-mapping settings, and Mistral OCR joining the ENABLE_FORWARD_USER_INFO_HEADERS integrations.
…dle timeout Adds the Files builtin tools category, which lets a model list, semantically query, grep and read the files attached to the current chat rather than having their text pasted into the prompt. Covers that it appears only when the model uploads files without using file context, the chat actually carries attachments, and the user holds the file upload permission, and that each file is re-checked against that user's access before being read. Records the Mark all as read entry on the sidebar Chats header, which clears every unread chat the user owns including those inside folders. Documents AIOHTTP_CLIENT_STREAM_IDLE_TIMEOUT, an optional between-chunks cap that aborts a stream which has gone silent without shortening a long but still-flowing response.
The system prompt now carries an attached_knowledge block naming each attached item with its type, ID and origin, so a model can scope a search to one knowledge base instead of guessing. Records that attachment is pooled from three places, treated alike by the tool availability matrix: knowledge on the model, knowledge on the chat's folder, and knowledge bases or notes attached to the chat itself, the last counting only when the model's File Context capability is off and the content is therefore not already in the conversation.
…etions The private-address guard now looks inside IPv6 rather than only at it: IPv4-mapped, IPv4-compatible, 6to4, Teredo and NAT64 addresses are globally routable as IPv6 while resolving somewhere internal, so the embedded IPv4 address is extracted and checked, at URL validation and again at connection time. Also records how images returned by a tool reach the model, riding inside the tool result on the Responses API but split into a following user message on Chat Completions, where a tool message carries text only, so the model can examine what a tool produced instead of receiving a result it cannot open.
…metadata Three configurable shortcuts join the list, all shipping unassigned so they cannot collide with an existing binding: navigating to the previous or next chat in the sidebar list, and toggling the controls panel. Records the Memory model capability, which decides whether stored memories are injected into that model's context and is distinct from the Memory builtin tool category the model uses to read and write them. Also notes that reasoning metadata arriving after the answer has begun is folded into the thinking block above it rather than appearing below, and that metadata without reasoning text no longer opens an empty block.
A list valve can now declare a multiselect input, rendering a checkbox dropdown that shows the chosen labels in the closed field. Options are declared as for a select, and the value stays a genuine list rather than making the comma-separated round trip other list valves take, so options containing a comma survive and the plugin receives exactly the values it defined.
The threshold check prefers the token counts a provider reported, walking back to the most recent message carrying usage and estimating only what follows it, and falls back to a full estimate when no message carries any. Records that the Ollama and llama.cpp vocabularies are read alongside the OpenAI-style ones, so local backends compact on reported numbers rather than drifting on estimates, and that the stored usage travels with the chat history so the count is available on later turns.
SEARXNG_CLIENT_CERT_FILE and SEARXNG_CLIENT_KEY_FILE let Open WebUI present a client certificate to a SearXNG instance that demands one. Records that the key path is only needed when the certificate file does not already contain it, that the resulting TLS context applies to SearXNG requests alone while everything else keeps the shared outbound settings, and that the certificate is loaded once per process so replacing it on disk calls for a restart.
Proxy trust, loader concurrency and SSL verification are read from the persisted web search configuration on each search, so a change saved in the admin panel applies to the next search without a restart and behaves as it does elsewhere. Records that the environment variable seeds the initial value while the saved setting wins afterwards, so an apparently ignored change should be checked in the admin panel first.
The parameter counts candidate tokens, so its slider and number box now step by one across 0 to 1000, and a fraction, a negative number or any other non-integer entry leaves the previous value standing rather than being accepted.
A new chat with nothing valid selected, because the model used last has been removed or hidden, now falls back to the configured default models once the model list has loaded, rather than leaving an empty selector. Records that a model or models URL parameter suppresses the fallback so the named model is waited for instead of being replaced.
…NOSE and OAuth tokens without an expiry A model summoned in a channel now stores and renders its full output, so reasoning, tool calls, generated images and code results appear there as they do in a chat instead of being flattened to text. Records that a stream filter's valves are resolved once per response rather than per chunk, so an edit made mid-reply lands on the next one. Adds LOGURU_DIAGNOSE, which annotates logged tracebacks with local variable values and is therefore off by default, since those frames routinely hold tokens, prompts and user content. Also covers what happens when a provider returns neither expires_in nor expires_at: with a refresh token the session assumes an hour and refreshes, without one the token is treated as non-expiring rather than being dropped after a fabricated expiry.
A streaming response now carries the upstream model's prompt cache counters, output token details and server tool use through to the closing message_delta rather than dropping them in translation, and reports input_tokens only when it is genuinely known instead of showing a fabricated zero.
…ompaction Extends the usage note to non-streaming responses, records that cached tokens reported OpenAI-style are mapped to the Anthropic cache read field and that input tokens exclude what is counted as cache creation or cache read, adds service tier to the passed-through fields, and states that upstream usage is only requested when the model carries the Usage capability. Also notes that a leading system message is held aside during context compaction and restored at the front, so it keeps its position instead of being treated as an ordinary message.
CONTEXT_COMPACTION_MODEL gives summarization a model of its own instead of borrowing the task model chosen for titles and tags, which matters because the summary has to stand in for a large part of the conversation. Records that an empty value keeps the previous behaviour, that the admin panel calls the same thing Context Compaction Model with Current Model meaning follow the chat, and that an unavailable model falls back to the task model and then the chat model so compaction still runs.
The toggle beside a terminal server connection now holds on every path: the model is not given the server's tools, the terminal and file browser refuse to connect, and proxied requests are rejected, so it can be used to retire a server without deleting the connection.
CHANNEL_MODEL_RESPONSE_MODE decides whether a model answering a top-level channel mention replies in a thread under that message, as it does by default, or straight into the timeline, while a mention inside a thread always answers there. CONTENT_EXTRACTION_SUPPORTED_MEDIA_MIME_TYPES turns the old external-engine special case into a choice: name the image or video types your engine can actually read and matching uploads are extracted whichever engine is configured, with an empty value disabling media extraction entirely and an unset value keeping the previous behaviour.
…iews Records how a custom automation rule is read: sub-daily frequencies snap to the clock when no start time is given, a DTSTART is honoured while it remains reachable and otherwise gives way to clock alignment, INTERVAL must be a positive whole number, only one RRULE is allowed and EXRULE is refused, and property names are case-insensitive. Also notes that an access preview now lists the resources a user owns alongside those granted to them, and leaves out deactivated models.
The caps that bound what knowledge tools return are now environment variables rather than constants: total output of one kb_exec call, files a single kb_exec grep may scan, matching lines returned by either grep, and the default and hard ceiling on a file read. Records each with its default and what raising or lowering it costs, and notes on the knowledge page that a kb_exec pipeline is bounded once as a whole, so a wide cat and a wide grep are capped alike.
A provider error while the agentic loop fetches the model's next turn now surfaces as an error on the message rather than a debug log line, so a run that ends early says why instead of appearing to stop for no reason. The code interpreter's continuation loop behaves the same way.
The per-call and whole-reply counts are now separate fields: prompt_tokens and completion_tokens describe the most recent model call, while input_tokens, output_tokens and total_tokens cover every call in the reply. Records that earlier releases put the running total in the first pair, so an integration that bills on them undercounts a reply that used tools and should read the cumulative fields instead.
Attaching a file, collection or note to a folder is now checked against what the folder's owner can read, so write access to a shared folder does not let someone place documents in it that its owner could not open, and a subfolder created inside a shared folder is held to the parent owner's access too. Records that a folder's chats re-check the attachments each time, so knowledge the owner has since lost access to stops being served through the folder, and that entries which cannot be access-checked are ignored.
… account creation The setting that restricts which OAuth client's tokens the exchange endpoint accepts is OAUTH_TOKEN_EXCHANGE_TRUSTED_CLIENT_IDS, and leaving it empty performs no client check rather than rejecting every exchange, so the pages now name it correctly and state plainly that an unset value accepts any token the provider validates. Also records that a trusted header account is created with an identifier derived from the email address, so simultaneous first requests resolve to one account instead of leaving duplicates.
A per-user Default Upload Mode setting decides whether a file attached in a chat starts as focused retrieval, as before, or as an entire document, so the choice no longer has to be made on each upload, and an individual file can still be switched afterwards. Also documents REDIS_SOCKET_TIMEOUT as the read and write companion to the connect timeout, with a warning that it also applies to the idle subscriber connection carrying stop requests between instances, which is why it is best left unset.
ENABLE_AUDIT_GET_REQUESTS widens audit logging from the methods that change something to reads as well, ENABLE_INITIAL_ADMIN_SIGNUP lets the first account be created through the signup endpoint on an instance whose login form is off, and USER_PERMISSIONS_CHAT_EXPORT is the variable behind the Export Chat group permission the RBAC page already lists.
…an block A partial unique index on the lower-cased email column now enforces one account per address regardless of capitalisation, and an upgrade onto a database that already holds such a pair stops and names every address involved instead of choosing between them. Adds a recovery section covering how to see the affected accounts, what each of them owns, and how to consolidate before rerunning the upgrade, since an emptied duplicate still blocks it.
…tion-y73xug Claude/pr commit dev integration y73xug
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
open-webui-docs-search | 84826d6 | Jul 27 2026, 09:44 AM |
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018EJ7TB6WngiNRTkWWpxdAq
style: apply Prettier formatting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.